How to Implement Security Scanning in ECC Workflows

ECC (Everything Claude Code) provides a native /security-scan command that executes AgentShield to analyze agents, hooks, MCP configurations, and secret usage, delivering a graded remediation plan that integrates seamlessly into both local development and CI/CD pipelines.

Everything Claude Code (ECC) ships with built-in security scanning capabilities designed to automatically vet AI agent configurations before they reach production. Implementing security scanning in ECC workflows allows development teams to detect hard-coded secrets, excessive permissions, and vulnerable dependencies across their agent ecosystems by leveraging the deterministic scanning engine defined in commands/security-scan.md. The system analyzes your repository against a comprehensive security checklist stored in skills/security-review/SKILL.md, providing immediate feedback and optional automated remediation.

Architecture of the ECC Security Scanner

The security scanning capability is composed of three interconnected components that work together to provide comprehensive coverage.

The security-scan Command

The primary entry point resides in commands/security-scan.md, which defines the CLI syntax and wraps the AgentShield engine. This command accepts parameters for output formatting (--format), severity thresholds (--min-severity), and automated remediation (--fix). According to the source implementation, the command defaults to the repository root (.) and produces structured output including a security grade, severity breakdown, and prioritized remediation actions【/commands/security-scan.md#L36-L67】.

The security-review Skill

The validation logic is encapsulated in skills/security-review/SKILL.md, which enumerates the specific security checks performed during scanning. This skill defines the checklist that validates against hard-coded secrets, broad permissions, unpinned npx executions, and other common agent-related vulnerabilities【/skills/security-review/SKILL.md】.

The security-reviewer Agent

For interactive troubleshooting and remediation guidance, ECC provides agents/security-reviewer.md. This agent can be invoked directly to answer questions about specific findings, explain remediation steps, or provide context about security policies【/agents/security-reviewer.md】.

Running Local Security Scans

Developers can execute security scanning locally before committing code to catch vulnerabilities early in the development cycle.

To run a comprehensive scan on the entire repository with human-readable output:

/security-scan . --format markdown --min-severity medium

This command performs the following actions:

• Scans all agents, hooks, MCP servers, and configuration files in the current directory
• Filters out low-severity findings based on the --min-severity threshold
• Outputs a security grade and score, counts by severity and confidence, and critical findings with exact file paths
• Provides a remediation order with specific paths, reasons, and auto-fix safety indicators【/commands/security-scan.md#L60-L68】

For CI-friendly machine parsing, use JSON output:

/security-scan src/api --format json --min-severity high

Automating Remediation with Safe Fixes

ECC supports deterministic automated patching for issues classified as safe to fix without human intervention.

To enable automated remediation, append the --fix flag:

/security-scan . --fix --format markdown

The execution flow follows these steps:

1. Preview Mode: The scanner first displays a "planned edits" preview showing exactly which files will be modified
2. Selective Patching: Applies only patches marked safe-to-auto-fix by AgentShield, avoiding potentially dangerous modifications
3. Validation: Automatically re-runs the scan after applying fixes to confirm the improved security score【/commands/security-scan.md#L54-L58】

CI/CD Integration for Continuous Security

Integrating the security scanner into continuous integration ensures that no insecure code reaches the main branch. The ECC ecosystem provides a GitHub Action that wraps the AgentShield engine.

Create .github/workflows/security.yml with the following configuration taken directly from the command documentation【/commands/security-scan.md#L70-L80】:

name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run ECC security scan
        uses: affaan-m/agentshield@v1
        with:
          path: "."
          min-severity: "medium"
          fail-on-findings: true

When configured with fail-on-findings: true, the workflow exits with an error code if any finding of medium severity or higher is detected, effectively blocking the merge until the issue is resolved.

Summary

• ECC provides native security scanning through the /security-scan command defined in commands/security-scan.md, which wraps the AgentShield engine to analyze agent configurations, hooks, and MCP servers.
• Local execution supports multiple output formats (markdown, text, JSON) and severity filtering via --min-severity to focus on high-priority issues.
• Automated remediation is available through the --fix flag, which applies only patches marked as safe-to-auto-fix and validates improvements through re-scanning.
• CI/CD integration uses the affaan-m/agentshield@v1 GitHub Action to enforce security gates, preventing merges when medium or high severity findings are detected.
• The security-review skill in skills/security-review/SKILL.md provides the authoritative checklist that defines what constitutes a vulnerability in ECC workflows.

Frequently Asked Questions

What specific security issues does the ECC scanner detect?

The scanner validates against a comprehensive checklist defined in skills/security-review/SKILL.md, including hard-coded secrets in agent configurations, overly broad MCP permissions, unpinned npx executions that could lead to supply chain attacks, and improper hook implementations. The AgentShield engine specifically targets vulnerabilities unique to AI agent architectures, such as excessive file system access permissions and insecure secret handling patterns【/skills/security-review/SKILL.md】.

Can I run the security scan on specific subdirectories rather than the entire repository?

Yes, the /security-scan command accepts a path argument that allows you to target specific directories. For example, /security-scan src/api --format markdown will scan only the src/api folder and its subdirectories. This is particularly useful for monorepos where you want to scan only the components modified in a specific commit or pull request【/commands/security-scan.md】.

How does the automated remediation feature determine which fixes are safe to apply?

The --fix flag utilizes AgentShield's safety classification system, which marks specific remediation actions as safe-to-auto-fix based on deterministic patterns that cannot break functionality. Before applying any changes, the command displays a "planned edits" preview. Only patches that modify non-critical configuration values, remove detected secrets, or tighten permission scopes without changing API contracts are auto-applied. After execution, the system automatically re-runs the scan to verify the security grade improvement【/commands/security-scan.md#L54-L58】.

Is the security scanning capability available for continuous integration pipelines outside of GitHub Actions?

While the raw analysis specifically documents the GitHub Action affaan-m/agentshield@v1, the underlying AgentShield engine is deterministic and command-line driven, making it adaptable to any CI/CD platform that supports containerized execution. The scanner outputs standardized formats (JSON and text) that can be consumed by Jenkins, GitLab CI, CircleCI, or other platforms. The fail-on-findings behavior can be replicated by checking the exit code or parsing the JSON output for severity counts in alternative CI environments【/commands/security-scan.md#L70-L80】.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}